PHP 5.2.7 contains an incorrect change to the FILTER_UNSAFE_RAW functionality, and unintentionally disables magic_quotes_gpc regardless of the actual magic_quotes_gpc setting, which might make it easier for context-dependent attackers to conduct SQL injection attacks and unspecified other attacks.

The remote host is affected by the vulnerability described in GLSA-201001-03 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the     CVE identifiers referenced below and the associated PHP release notes     for details.
  Impact :

    A context-dependent attacker could execute arbitrary code via a     specially crafted string containing an HTML entity when the mbstring     extension is enabled. Furthermore a remote attacker could execute     arbitrary code via a specially crafted GD graphics file.
    A remote attacker could also cause a Denial of Service via a malformed     string passed to the json_decode() function, via a specially crafted     ZIP file passed to the php_zip_make_relative_path() function, via a     malformed JPEG image passed to the exif_read_data() function, or via     temporary file exhaustion. It is also possible for an attacker to spoof     certificates, bypass various safe_mode and open_basedir restrictions     when certain criteria are met, perform Cross-site scripting attacks,     more easily perform SQL injection attacks, manipulate settings of other     virtual hosts on the same server via a malicious .htaccess entry when     running on Apache, disclose memory portions, and write arbitrary files     via a specially crafted ZIP archive. Some vulnerabilities with unknown     impact and attack vectors have been reported as well.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of PHP installed on the remote host is 5.2.7.  This version introduced a regression with regard to 'magic_quotes' functionality due to an incorrect fix to the filter extension.  As a result, the 'magic_quotes_gpc' setting remains off even if it is set to on. 

According to its banner, the version of PHP installed on the remote host is earlier than 5.2.8.  As such, it is potentially affected by the following vulnerabilities :

  - PHP fails to properly sanitize error messages of     arbitrary HTML or script code, would code allow for     cross-site scripting attacks if PHP's 'display_errors'     setting is enabled. (CVE-2008-5814)

  - Version 5.2.7 introduced a regression with regard to     'magic_quotes' functionality due to an incorrect fix to     the filter extension.  As a result, the     'magic_quotes_gpc' setting remains off even if it is set     to on. (CVE-2008-5844)

PHP Developers reports :

Due to a security bug found in the PHP 5.2.7 release, it has been removed from distribution. The bug affects configurations where magic_quotes_gpc is enabled, because it remains off even when set to on.

According to its banner, the version of PHP installed on the remote host is 5.2.7.  This version introduced a regression with regard to 'magic_quotes' functionality due to an incorrect fix to the filter extension.  As a result, the 'magic_quotes_gpc' setting remains off even if it is set to on.

ID	Name	Product	Family	Severity
44892	GLSA-201001-03 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
4784	PHP 5.x < 5.2.8 magic_quotes_gpc Security Bypass	Nessus Network Monitor	Web Servers	high
35067	PHP < 5.2.8 Multiple Vulnerabilities	Nessus	CGI abuses	high
35050	FreeBSD : php5 -- potential magic_quotes_gpc vulnerability (1f9e2376-c52f-11dd-8cbc-00163e000016)	Nessus	FreeBSD Local Security Checks	high
801078	PHP < 5.2.8 magic_quotes_gpc Security Bypass	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2008-5844

critical

Tenable Plugins

critical

high

high

high

high